http://legalref.judiciary.hk/lrs/common/search/search_result_detail_frame.jsp?DIS=86744&QS=%28%7B%E5%85%92%E7%AB%A5%E8%89%B2%E6%83%85%7D+%25charge%29&TP=RV
Preliminary examination
40. The computer was seized on the 15 April 2010 and first examined by PC3379 (PW4), the expert, on the 23 April 2010 when he performed the process of ‘Forensic Image Acquisition’ by using computer forensics software “EnCase” (see paragraph 4, exhibit P8),
41. When PC 58917 examined the computer at the home of the defendant on the 15 April 2010 he used a programme called “SPADA” which had been designed specifically for forensic examination. Using the image search function of “SPADA” no child pornographic images were found. In cross-examination PC 58917 explained that as the “SPADA” programme was designed several years ago and no updates had been provided, “SPADA” may not be able to access everything on the computer. This was because the “SPADA” programme may not be completely compatible with the hardware of more recent computers resulting in “SPADA” not being able to read all the data on the computer.
42. PC 58917 told the court that although he was aware at the time of his examination of the shortcomings of “SPADA” he made no record of this in his witness statement or in the investigation report. PC 58917 said he thought this was not necessary and in answer to the court explained his witness statement was mainly to record what operation he carried out.
43. Mr Wong submits the failure to record “SPADA” has not been updated and therefore may be the reason why no child pornography was found on the computer during the preliminary examination invites grave suspicion that the child pornography may have found their way onto the computer after the examination by PC 58917 (see paragraph 11 of the written submission of Mr Wong). I have no hesitation in rejecting this submission.
44. I accept the evidence of PC 3379 that “SPADA” permitted only a preliminary examination, whereas the software “EnCase” has more powerful functions and permits a more detailed examination. I am satisfied so I am sure the only inference to draw is that the child pornography was on the computer at the time of seizure on the 15 April 2010. Whilst surprising the police used an old software programme with known shortcomings to conduct the preliminary examination the fact that PC 58917 did not find any child pornography during the preliminary examination and did not record in his witness statement the shortcomings of “SPADA” as the possible reason for this do not cause me to doubt this is the only inference to draw.